Impact
LiteLLM contains a critical SQL injection vulnerability in its Proxy API key verification process [S1]. This flaw allows unauthenticated attackers to bypass security checks and potentially access or exfiltrate data from the underlying database [S1][S3].
Root Cause
The issue is identified as CWE-89 (SQL Injection) [S1]. It is located in the API key verification logic of the LiteLLM Proxy component [S2]. The vulnerability stems from insufficient sanitization of input used in database queries [S1].
Affected Versions
LiteLLM versions 1.81.16 through 1.83.6 are affected by this vulnerability [S1].
Concrete Fixes
Update LiteLLM to version 1.83.7 or higher to mitigate this vulnerability [S1].
How FixVibe tests for it
FixVibe now includes this in GitHub repo scans. The check reads authorized repository dependency files only, including requirements.txt, pyproject.toml, poetry.lock, and Pipfile.lock. It flags LiteLLM pins or version constraints that match the affected range >=1.81.16 <1.83.7, then reports the dependency file, line number, advisory IDs, affected range, and fixed version.
This is a static, read-only repo check. It does not execute customer code and does not send exploit payloads.